Mar 25, 2011 07:31 PM
(This post was last modified: Apr 17, 2011 11:31 PM by carecare.)
Protect yourself: Monitor your connections
- Difficulty (Intermediate): *****■*****■***** -
- Difficulty (Intermediate): *****■*****■***** -
Hey and welcome to Part 1 in my new "Protection Series" first off is monitoring connections.
I'm planning on writing more tutorials, that is if anyones interested. If so you're welcome to make requests!
I always try to keep my tutorials easy & direct instead of writing walls of irrelevant text.
01 Introduction
One important step in ensuring your personal security is being able to monitor your local network traffic and look for anomalities, lets face it the whole virus era is basically history, nowdays we face threats such as botnets/trojans/adware which is normally controlled by people with malicious intent who have no problems whatsoever in stealing your sensitive passwords/use your computer in various botnet attacks, that said a basic understanding of your network connections is a great step towards securing yourself from online threats. Enough talk let's get on it!
02 Table of contents
- Chapter 1. Introduction to TCPView
Chapter 2. Detecting & dealing with malware using TCPView
Chapter 3. Tips
03 Tools used in this tutorial
CHAPTER 1
Introduction to TCPView
Introduction to TCPView
[img]http://img708.imageshack.us/img708/5843/tcpnmbr.png[/img]
1. (Process) Displays the name of the associated process
2. (PID) Displays the ID linked to the process; Process ID Number "PID"
3. (Protocol) Displays the used protocol (TCP/UDP)
4. (Local Adress) Displays your adress
5. (Local Port) Displays the local port
6. (Remote Adress) Displays the adress which the process is communicating to
7. (Remote Port) Displays the port that the process is connected to
8. (State) Displays the current STATE of the process.
SYN_SEND Indicates active open.
SYN_RECEIVED Server just received SYN from the client.
ESTABLISHED Client received server's SYN and session is established.
LISTEN Server is ready to accept connection.
9. (Sent/Recieved Packets) Displays in bytes the amount of data sent
What is TCPView?
In short, TCPView is a tool which monitors active processes network connection(s).
Some of you might be familiar with the built-in tool "netstat" which is excellent in terms of monitoring and detecting in/outgoing connections, however it's limited and lacks many important features, luckily there is an alternative called TCPView which is an lifesaver, it's made by the former glory sysinternals. The beauty with this tool is that you'll be able to see and determine every processes network connection(s) without having to crosscheck the PID's in taskmanager like you have with netstat.
Some benefits of using TCPView
[✔] A good replacement to netstat
[✔] Easy GUI
[✔] Refreshes active process states automaticly
[✔] Displays associated ports
[✔] Great process association
[✔] Generally bypasses rootkits
CHAPTER 2
Detecting & dealing with malware using TCPView
Detecting & dealing with malware using TCPView
In order to demonstrate typical usage for TCPView i'll provide an image of an infected computer (see below)
[img]http://img17.imageshack.us/img17/5188/iexpl.png[/img]
Can you detect the malware? First off, what we want to look for here is anomalities, everything that stands out so be paranoid - malware is often characterized by:
- Having unknown/odd process names
- Having STATE established on weird ports
- Uknown endpoints
- Non logic processes (ie. seeing an closed trusted application trying to communicate outgoing, ie Internet Explorer)
- Connection tampering, most malware (Trojans especially) will repetively try to connect back to the attacker - resulting in an odd network behaviour. (see video)
Found it? If you haven't don't worry, it's not always easy since hackers (crackers?) work hard in masking their malware, in any case the answer is: Spoiler (Click to View)
Why? you might ask. First of:
1. No valid file signature/version
[img]http://img826.imageshack.us/img826/9503/ieieieieieie3423442.png[/img]
Dont be tricked by the icon, malware often mimics trusted applications! In this image you'll see that the file "iexplore.exe" has no file signature/version (In this case it should be by Microsoft) therefore it's a non-valid Microsoft application and most likely a spoof.
Quote:Do notice that some malware injects themselves to processes, if youre unsure about a file always upload & scan it on ie. VirusTotal
2. Odd file path
The file "iexplore.exe" shoulden't reside in "C:\Windows\system32" since it isn't a system file.
3. Suspicious port
Internet Explorer is a web browser, seeing it interact with ports other than (HTTP/HTTPS/80/8080) should make you suspicious.
4. IE is not visible in explorer
If you cannot see the affected program it's most likely a decoy/fake. Since every malware operates hidden.
CHAPTER 3
Tips
Tips
1. Check for connection tampering
Most malware that is controlled (RATs/Trojans/Bots etc) will always try connecting back to the attacker in intervals, I like to call this behaviour connection tampering and it's easily noticed.
If we try and terminate the connection it will most likely respawn, if it does we can safely confirm that it's a malware; (see Connection tampering video)
I provied an example with a trojan in action trying to connect to it's master (process named "svhost.exe") notice the behaviour.
Quote:If the attacker already has an connection to you, it wont display this behaviour and it will have an "ESTABLISHED" state. To prevent this, try taking out the internet cable to ensure no outside connections is possible.
2. Always virus scan suspicious files
To be on the safe side always scan the suspicious file for infections, by right clicking the suspicious process we can find out what file it is associated to, if the file is a malware it has most likely already bypassed your current antivirus so try uploading it to ie. VirusTotal / novirusthanks or any other online malware scanner.
3. Check the associated process file-signature
X Unsigned & Unverified process (svhost.exe)
[IMG]http://img535.imageshack.us/img535/8316/fasfaas.png[/IMG]
✔ Signed & Verified process (svchost.exe)
[IMG]http://img27.imageshack.us/img27/3302/dasdasdasdsa.png[/IMG]
Most malware claims that they are components to a trusted program (ieupdater.exe, svhost.exe, winlogon.exe, winfix.exe) In this example, svhost.exe is the malware. If a process claims to be something its not always check the files signature, if it isn't signed, it's most likely a malware.
4. Google the associated process name & port
Try a google search on the suspicous process & port number to verify if it's a legit process or not, and also to check if the port is valid.
4. Use common sense
That's right, the best defense is and will always be: to use common sense.
Let's say you find a process named "fsdgs.exe" in the active process list, it's not very likely that it's a legit child process to Windows :) don't trust any process you don't know about.
5. On suspicion: always turn off your internet
If youre suspicous and feel like something ain't right (Internet is going slow etc) simply turn off your internet to avoid further problems. As long as your connected to the internet the attacker can operate freely in your computer & cause even more damage.
~
![[Image: Sqd9U.png]](https://i.imgur.com/Sqd9U.png)
